Senior Detection & Threat Engineer

Academic Key; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

Checkout.com in London is seeking a Senior Detection & Threat Engineer to own and evolve the company’s threat detection and threat-hunting capability. This role defines what “good” looks like for detection and progressively engineers it as capability shifts into Cyber Security.

You will partner with Security Operations, GRC and Engineering, setting standards and taking ownership of the most complex detection and threat engineering work.

Qualifications

• Proven experience in detection engineering, threat hunting, or advanced SOC roles.
• Deep understanding of attacker tradecraft and intrusion techniques.
• Hands-on experience building detection logic in modern SIEM platforms (e.g. Sentinel).
• Proficiency with scripting (Python, KQL) to build detection pipelines and automation.

Responsibilities

• Engineer high-fidelity threat detections across endpoint, identity, cloud, and SaaS.
• Define detection standards and quality thresholds for Security Operations.
• Conduct proactive threat hunting based on attacker behaviour, not vendor alerts.
• Translate threat intelligence and incident learnings into durable, reusable detections.
• Map detections to MITRE ATT&CK and real-world attack paths.
• Reduce alert fatigue through logic refinement and contextual enrichment.
• Advise during high-severity security incidents; contribute to runbooks and escalation playbooks.
• Drive the transition of advanced detection capability into Cyber Security ownership.

Skills

Threat detection

Threat hunting

SOC experience

Python

KQL

SIEM

Cloud security

Attacker tradecraft

MITRE ATT&CK

Tools

Sentinel

Threat intelligence platforms

Job description

Senior Detection & Threat Engineer

Checkout.com · London

Abroad London Full Time Link validated

Company Description We’re Checkout.com . You might not know our name, but companies like eBay, Spotify, Klarna, Uber, and Sony do, because we’re behind many of the digital experiences you use every day. We are where the world checks out, enabling over 10 billion transactions yearly for more than one billion global shoppers. Whether you want to book a holiday, order food, renew a subscription, or check out online, there’s a good chance our tech powers the payments behind the scenes. Our platform helps the most ambitious businesses deliver effortless digital experiences, at scale. If you want to do career-defining work, you’ve come to the right place. We move fast, think globally, and believe great teams are built by hiring exceptional people with conviction, curiosity, and the desire to make an impact. With 20 offices across six continents and London as our HQ, we’re shaping the future of fintech – and we’re just getting started. The role You will own and evolve the company’s threat detection and threat-hunting capability. This role defines what “good” looks like for detection and increasingly engineers it directly as capability shifts into Cyber Security. This is not an alert-triage role. You are here to understand attacker behaviour, convert it into high-fidelity detection logic, and raise the security baseline for the entire organisation. You will partner closely with Security Operations, GRC and Engineering—setting standards, direction, and expectations—while progressively taking ownership of the most complex and high-value detection and threat engineering work.

What you’ll be responsible for

• Engineering high-fidelity threat detections across endpoint, identity, cloud, and SaaS
• Defining detection standards, principles, and quality thresholds for Security Operations
• Conducting proactive threat hunting based on attacker behaviour, not vendor alerts
• Translating threat intelligence and incident learnings into durable, reusable detections
• Mapping detections to MITRE ATT&CK and real-world attack paths
• Reducing alert fatigue through logic refinement, correlation, and contextual enrichment
• Advising and supporting during high-severity security incidents; contribute to runbooks and escalation playbooks
• Driving the transition of advanced detection capability into Cyber Security ownership

What we’re looking for

• Proven experience in detection engineering, threat hunting, or advanced SOC roles
• Deep understanding of modern attacker tradecraft and intrusion techniques across the attack lifecycle
• Hands-on experience buidling detection logic in modern SIEM platforms (e.g Sentinel)
• Proficienty with scripting and programmaining (e.g. Python, KQL) to build detection pipelines and automation
• Willingness to challenge bad detections, weak assumptions, and vanity metrics
• Pragmatic mindset: precision and impact beat coverage theatre
• Experience operating beyond traditional SOC or MSSP models
• Hands-on cloud detection experience (identity, control plane, SaaS)
• Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud.

Additional Information Bring all of you to work We create the conditions for high performers to thrive, through real ownership, fewer blockers, and work that makes a difference from day one. Here, you’ll move fast, take on meaningful challenges, and be recognized for the impact you deliver. It’s a place where ambition gets met with opportunity, and where your growth is in your hands. We work as one team, and we back each other to succeed. So whatever your background or identity, if you’re ready to grow and make a difference, you’ll be right at home here. It’s important we set you up for success and make our process as accessible as possible. So let us know in your application, or tell your recruiter directly, if you need anything to make your experience or working environment more comfortable.

Academic Key will never request login credentials or application fees for this role.